plugin

Tatsu Vulnerabilities

1 known security issue reported for the Tatsu WordPress plugin. Most recent disclosed Mar 28, 2022.

1 medium

Running Tatsu on your site? Check whether your installed version is affected.

Tatsu <= 3.3.12 - Unauthenticated Remote Code Execution

medium

The Tatsu WordPress plugin before 3.3.13 add_custom_font action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory. By adding a PHP shell with a filename starting with a dot ".", this can bypass extension control implemented in the plugin. Mo...

CVSS:: 6.5
Affected:: up to 3.3.12
Fixed in:: 3.3.13
Disclosed:: Mar 28, 2022

CVE-2021-25094 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database